Data Retention & Disposal Policy
Effective March 5, 2026
1. Purpose
This policy defines how attune retains, manages, and disposes of user data. We collect only what is necessary to provide the service, retain it only as long as needed, and delete it when it is no longer required.
2. Data We Collect
| Category | Examples |
|---|---|
| Account | Email, display name, authentication tokens |
| Journal & Observations | Journal entries, tracked metrics, self-reported data |
| Goals & Plans | Stories, outcomes, trackers you create |
| Integrations | Calendar events, financial summaries (via Plaid), contacts |
| Location | Coarse location fixes (used for context, stored as geohash) |
| AI-Generated | Insights, nudges, and suggestions produced by our AI pipeline |
| Technical | Device info, crash logs, sync metadata |
3. Retention Periods
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days |
| User-created content (journals, goals, trackers) | Duration of account + 30 days |
| Integration data (calendar, financial) | Duration of integration connection + 30 days after disconnection |
| Location data | Rolling 90-day window; older fixes are automatically purged |
| AI-generated insights | Duration of account; regenerable on demand |
| Authentication tokens | Until expiry or revocation |
| Technical/crash logs | 90 days |
| Backups | 30 days after source data deletion |
4. Account Deletion
You may request deletion of your account and all associated data at any time by emailing you@snappleby.xyz. Upon receiving a verified deletion request:
- All personal data is removed from production systems within 30 days.
- Data is purged from backups within an additional 30 days.
- Integration tokens (e.g., Plaid, calendar) are revoked immediately.
5. Disposal Methods
When data reaches the end of its retention period or a deletion request is processed:
- Database records are permanently deleted (hard delete), not merely soft-deleted or anonymized.
- Backups containing deleted data are overwritten as part of the regular backup rotation cycle.
- Third-party tokens (OAuth, Plaid) are revoked via the provider's API.
- Local device data is cleared when you sign out or uninstall the app.
6. Third-Party Data Processors
We use the following processors, each bound by their own data handling agreements:
- Google Cloud Platform — infrastructure hosting and database storage
- Plaid — financial data aggregation (only when you connect a financial account)
- Anthropic — AI processing for insights and suggestions
We do not sell, rent, or share your personal data with any third party for advertising or marketing purposes.
7. Data Portability
You may request a full export of your data at any time by contacting you@snappleby.xyz. Exports are provided in standard machine-readable formats (JSON/CSV).
8. Policy Review
This policy is reviewed at least annually and updated as our practices evolve. Material changes will be communicated to users via email or in-app notification.
9. Contact
Questions about this policy or your data can be directed to you@snappleby.xyz.